TapestryHealth, which provides care management services to patients during stays at post-acute care facilities, has notified patients that one of its contracted employees engaged in unauthorized job-sharing. According to the company, this employee allowed an unidentified individual outside the organization to perform parts of their job and, in doing so, view certain patients’ personal information. This is categorized as a case of unauthorized employee access. TapestryHealth says the activity occurred between November 6, 2024 and November 3, 2025, and it discovered the issue on November 3, 2025. An investigation was completed on December 5, 2025, and the company reports the employee involved was immediately terminated.
The letter is addressed to a specific patient and does not state a total number of people affected. Anyone who received care management services from TapestryHealth during a stay at a post-acute care facility during the window above may have been affected. The company says it has no evidence to date that any patient information has actually been misused.
What information was exposed?
- Last name
- Facility name
- Room number
- Date(s) of admission
- Medical record number
- Provider names
- Diagnosis and treatment information
- Vitals
- Immunizations
- Medications
- Care plan goals and progress notes
TapestryHealth states that Social Security numbers, health insurance information, bank information, credit or debit card numbers, and driver’s license or government ID numbers were not involved. As a courtesy, the company is offering 12 months of free credit monitoring and identity protection through IDX. You can enroll at app.idx.us/account-creation/protect using the enrollment code included in your letter, and enrollment must be completed by March 22, 2026.
What should you do now?
- Enroll in the free IDX credit monitoring and identity protection service before the March 22, 2026 deadline, since it must be activated to work.
- Bring a photo ID to your medical appointments and confirm your address, phone number, and date of birth with your provider’s office so any discrepancies are caught early.
- Review statements from your healthcare providers and insurance company for any charges or services you don’t recognize, and report anything questionable right away.
- Consider placing a free fraud alert or security freeze with Equifax, Experian, and TransUnion, since detailed medical and facility records can be used to impersonate you in healthcare or insurance settings.
- Check your credit report for free at annualcreditreport.com and dispute any inaccuracies you find.
- For ongoing peace of mind, consider signing up for a service like Aura or LifeLock, which can alert you if your information appears elsewhere.
- Watch for phishing attempts referencing your medical care, since exposed medical record numbers and provider names could be used to make scam messages look legitimate.
If you have questions, TapestryHealth can be reached at 1-833-802-8116, available 9:00 a.m. to 9:00 p.m. Eastern Time, Monday through Friday.